{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:chainsafe:js-libp2p-noise:*:*:*:*:*:node.js:*:*",
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "4.1.2"
              },
              {
                "introduced": "5.0.0"
              },
              {
                "fixed": "5.0.3"
              }
            ],
            "source": [
              "CPE_RANGE",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "fe306a6992d7199bf90654e86664f41304b0da67"
            },
            {
              "introduced": "6dd8492e8cecbe8a55cf55845a789b809d3529ac"
            },
            {
              "fixed": "790b039023c72005536831a3ab6ab16a04645883"
            }
          ],
          "repo": "https://github.com/chainsafe/js-libp2p-noise",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-j3ff-xp6c-6gcc"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24759.json"
  },
  "details": "`@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Users should upgrade to version 4.1.2 or 5.0.3 to receive a patch. There are currently no known workarounds.",
  "id": "CVE-2022-24759",
  "modified": "2026-07-15T01:49:02.657599735Z",
  "published": "2022-03-17T16:40:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ChainSafe/js-libp2p-noise/releases/tag/v5.0.3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24759.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/ChainSafe/js-libp2p-noise/security/advisories/GHSA-j3ff-xp6c-6gcc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24759"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ChainSafe/js-libp2p-noise/pull/130"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Failure to validate signature during handshake in @chainsafe/libp2p-noise"
}